Procedure

1. Steps that are required only once:

   1. Optionally, set the owner of the script to root:

      # chown root /etc/nftables/example_firewall.nft

   2. Make the script executable for the owner:

      # chmod u+x /etc/nftables/example_firewall.nft

2. Run the script:

   # /etc/nftables/example_firewall.nft

   If no output is displayed, the system executed the script successfully.

   Important

   Even if nft executes the script successfully, incorrectly placed rules, missing parameters, or other problems in the script can cause that the firewall behaves not as expected.

Procedure

1. Edit the /etc/sysconfig/nftables.conf file.

   • If you enhance *.nft scripts created in /etc/nftables/ when you installed the nftables package, uncomment the include statement for these scripts.

   • If you write scripts from scratch, add include statements to include these scripts. For example, to load the /etc/nftables/example.nft script when the nftables service starts, add:

     include "/etc/nftables/example.nft"

2. Enable the nftables service.

   # systemctl enable nftables

3. Optionally, start the nftables service to load the firewall rules without rebooting the system:

   # systemctl start nftables

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the prerouting chain, the nftables framework requires this chain to match incoming packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that matches outgoing packets on the ens3 interface:

   # nft add rule nat postrouting oifname "ens3" masquerade

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the postrouting chain that replaces the source IP of outgoing packets through ens3 with 192.0.2.1:

   # nft add rule nat postrouting oifname "ens3" snat to 192.0.2.1

Procedure

1. Create a table:

   # nft add table nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain nat postrouting { type nat hook postrouting priority 100 \; }

   Important

   Even if you do not add a rule to the postrouting chain, the nftables framework requires this chain to match outgoing packet replies.

   Note that you must pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming traffic on the ens3 interface sent to port 80 and 443 to the host with the 192.0.2.1 IP:

   # nft add rule nat prerouting iifname ens3 tcp dport { 80, 443 } dnat to 192.0.2.1

4. Depending on your environment, add either a SNAT or masquerading rule to change the source address:

   1. If the ens3 interface used dynamic IP addresses, add a masquerading rule:

      # nft add rule nat postrouting oifname "ens3" masquerade

   2. If the ens3 interface uses a static IP address, add a SNAT rule. For example, if the ens3 uses the 198.51.100.1 IP address:

      nft add rule nat postrouting oifname "ens3" snat to 198.51.100.1

Procedure

1. For example, to add a rule to example_chain in example_table that allows incoming traffic to port 22, 80, and 443:

   # nft add rule inet example_table example_chain tcp dport { 22, 80, 443 } accept

2. Optionally, display all chains and their rules in example_table:

   # nft list table inet example_table
   table inet example_table {
     chain example_chain {
       type filter hook input priority 0; policy accept;
       tcp dport { ssh, http, https } accept
     }
   }

Procedure

1. Create an empty set. The following examples create a set for IPv4 addresses:

   • To create a set that can store multiple individual IPv4 addresses:

     # nft add set inet example_table example_set { type ipv4_addr \; }

   • To create a set that can store IPv4 address ranges:

     # nft add set inet example_table example_set { type ipv4_addr \; flags interval \; }

   Important

   To avoid that the shell interprets the semicolons as the end of the command, you must escape the semicolons with a backslash.

2. Optionally, create rules that use the set. For example, the following command adds a rule to the example_chain in the example_table that will drop all packets from IPv4 addresses in example_set.

   # nft add rule inet example_table example_chain ip saddr @example_set drop

   Because example_set is still empty, the rule has currently no effect.

3. Add IPv4 addresses to example_set:

   • If you create a set that stores individual IPv4 addresses, enter:

     # nft add element inet example_table example_set { 192.0.2.1, 192.0.2.2 }

   • If you create a set that stores IPv4 ranges, enter:

     # nft add element inet example_table example_set { 192.0.2.0-192.0.2.255 }

     When you specify an IP address range, you can alternatively use the Classless Inter-Domain Routing (CIDR) notation, such as 192.0.2.0/24 in the above example.

Procedure

1. Create the example_table:

   # nft add table inet example_table

2. Create the tcp_packets chain in example_table:

   # nft add chain inet example_table tcp_packets

3. Add a rule to tcp_packets that counts the traffic in this chain:

   # nft add rule inet example_table tcp_packets counter

4. Create the udp_packets chain in example_table

   # nft add chain inet example_table udp_packets

5. Add a rule to udp_packets that counts the traffic in this chain:

   # nft add rule inet example_table udp_packets counter

6. Create a chain for incoming traffic. For example, to create a chain named incoming_traffic in example_table that filters incoming traffic:

   # nft add chain inet example_table incoming_traffic { type filter hook input priority 0 \; }

7. Add a rule with a literal map to incoming_traffic:

   # nft add rule inet example_table incoming_traffic ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }

   The literal map distinguishes the packets and sends them to the different counter chains based on their protocol.

8. To list the traffic counters, display example_table:

   # nft list table inet example_table
   table inet example_table {
     chain tcp_packets {
       counter packets 36379 bytes 2103816
     }
   
     chain udp_packets {
       counter packets 10 bytes 1559
     }
   
     chain incoming_traffic {
       type filter hook input priority 0; policy accept;
       ip protocol vmap { tcp : jump tcp_packets, udp : jump udp_packets }
     }
   }

   The counters in the tcp_packets and udp_packets chain display both the number of received packets and bytes.

Procedure

1. Create a table. For example, to create a table named example_table that processes IPv4 packets:

   # nft add table ip example_table

2. Create a chain. For example, to create a chain named example_chain in example_table:

   # nft add chain ip example_table example_chain { type filter hook input priority 0 \; }

   Important

   To avoid that the shell interprets the semicolons as the end of the command, you must escape the semicolons with a backslash.

3. Create an empty map. For example, to create a map for IPv4 addresses:

   # nft add map ip example_table example_map { type ipv4_addr : verdict \; }

4. Create rules that use the map. For example, the following command adds a rule to example_chain in example_table that applies actions to IPv4 addresses which are both defined in example_map:

   # nft add rule example_table example_chain ip saddr vmap @example_map

5. Add IPv4 addresses and corresponding actions to example_map:

   # nft add element ip example_table example_map { 192.0.2.1 : accept, 192.0.2.2 : drop }

   This example defines the mappings of IPv4 addresses to actions. In combination with the rule created above, the firewall accepts packet from 192.0.2.1 and drops packets from 192.0.2.2.

6. Optionally, enhance the map by adding another IP address and action statement:

   # nft add element ip example_table example_map { 192.0.2.3 : accept }

7. Optionally, remove an entry from the map:

   # nft delete element ip example_table example_map { 192.0.2.1 }

8. Optionally, display the rule set:

   # nft list ruleset
   table ip example_table {
     map example_map {
       type ipv4_addr : verdict
       elements = { 192.0.2.2 : drop, 192.0.2.3 : accept }
     }
   
     chain example_chain {
       type filter hook input priority 0; policy accept;
       ip saddr vmap @example_map
     }
   }

Procedure

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }

   Note

   Pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming packets on port 8022 to the local port 22:

   # nft add rule ip nat prerouting tcp dport 8022 redirect to :22

Procedure

1. Create a table named nat with the ip address family:

   # nft add table ip nat

2. Add the prerouting and postrouting chains to the table:

   # nft -- add chain ip nat prerouting { type nat hook prerouting priority -100 \; }
   # nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }

   Note

   Pass the -- option to the nft command to avoid that the shell interprets the negative priority value as an option of the nft command.

3. Add a rule to the prerouting chain that redirects incoming packets on port 443 to the same port on 192.0.2.1:

   # nft add rule ip nat prerouting tcp dport 443 dnat to 192.0.2.1

4. Add a rule to the postrouting chain to masquerade outgoing traffic:

   # nft add rule ip daddr 192.0.2.1 masquerade

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

Procedure

1. Add a new rule with the counter parameter to the chain. The following example adds a rule with a counter that allows TCP traffic on port 22 and counts the packets and traffic that match this rule:

   # nft add rule inet example_table example_chain tcp dport 22 counter accept

2. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority 0; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority 0; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

2. Add the counter by replacing the rule but with the counter parameter. The following example replaces the rule displayed in the previous step and adds a counter:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 counter accept

3. To display the counter values:

   # nft list ruleset
   table inet example_table {
     chain example_chain {
       type filter hook input priority 0; policy accept;
       tcp dport ssh counter packets 6872 bytes 105448565 accept
     }
   }

Procedure

1. Display the rules in the chain including their handles:

   # nft --handle list chain inet example_table example_chain
   table inet example_table {
     chain example_chain { # handle 1
       type filter hook input priority 0; policy accept;
       tcp dport ssh accept # handle 4
     }
   }

2. Add the tracing feature by replacing the rule but with the meta nftrace set 1 parameters. The following example replaces the rule displayed in the previous step and enables tracing:

   # nft replace rule inet example_table example_chain handle 4 tcp dport 22 meta nftrace set 1 accept

3. Use the nft monitor command to display the tracing. The following example filters the output of the command to display only entries that contain inet example_table example_chain:

   # nft monitor | grep "inet example_table example_chain"
   trace id 3c5eb15e inet example_table example_chain packet: iif "enp1s0" ether saddr 52:54:00:17:ff:e4 ether daddr 52:54:00:72:2f:6e ip saddr 192.0.2.1 ip daddr 192.0.2.2 ip dscp cs0 ip ecn not-ect ip ttl 64 ip id 49710 ip protocol tcp ip length 60 tcp sport 56728 tcp dport ssh tcp flags == syn tcp window 64240
   trace id 3c5eb15e inet example_table example_chain rule tcp dport ssh nftrace set 1 accept (verdict accept)
   ...

   Warning

   Depending on the number of rules with tracing enabled and the amount of matching traffic, the nft monitor command can display a lot of output. Use grep or other utilities to filter the output.

Procedure

1. To backup nftables rules:

   • In nft list ruleset format:

     # nft list ruleset > file.nft

   • In JSON format:

     # nft -j list ruleset > file.json

Procedure

1. To restore nftables rules:

   • If the file to restore is in nft list ruleset format or contains nft commands:

     # nft -f file.nft

   • If the file to restore is in JSON format:

     # nft -j -f file.json